Is storing an OAuth token in cookies bad practise?
Whether you can store the access_token in cookies depends on following things:
- Is the access_token stored in cookie encrypted or not (it definitely should be)
- Access_token is a bearer token so it is not tied to browser flows. Cookies in general are meant for maintaining state in browsers. So if lifecycle of token is same as cookie, go ahead otherwise not. When I say lifecycle, I mean lifespan, etc.
- Also, please consider this fact too that access token is not identity token
- Access tokens are completely client side, and servers that generally use cookies to maintain sessions, mostly maintain matching server side session as well.
I hope this helps.
I definitely wouldn't do it. When security is involved you should not store stuff, in places where others can access it. So don't store it anywhere, especially client-side.
That being said, it's not bad practice, per se if handled properly. See this comprehensive article about it.